Money Talks: Important Takeaways from the OIG’s Civil Monetary Penalties Final Rule

In a burst of rulemaking in December 2016, the US Department of Health and Human Services (HHS), Office of Inspector General (OIG), issued two new final rules containing significant changes to OIG’s Civil Monetary Penalty (CMP) authorities. We covered the first rule, addressing multiple issues regarding the beneficiary inducement CMP statute as well as new anti-kickback statute safe harbors. In the second rule, OIG tackled all the other wide-ranging CMPs it can assess against health care providers, suppliers, managed care organizations and drug manufacturers. This On the Subject gives an overview of this second rule.

Revised Aggravating and Mitigating Factors Incentivize Self-Disclosure

OIG made substantial changes to the structure of the CMP regulations at 42 CFR Part 1003. The rule streamlined the regulation to create topic-specific subparts for different CMPs (e.g., false claims, anti-kickback and Stark Law, etc). As part of this reorganization, OIG created a global list of aggravating and mitigating factors that it considers in assessing monetary penalty amounts and exclusion “to add clarity and improve transparency in OIG’s decision-making process.” OIG is careful to say that these factors are illustrative, not comprehensive, with additional specificity contained in a subject matter subpart.

The global factors are (1) the nature and circumstances of the violation; (2) the person’s degree of culpability; (3) the person’s or entity’s history of prior offenses; (4) other wrongful conduct; and (5) other matters, as justice may require. Key points on these factors include the following:

• OIG emphasized that weighing these factors is done on a “case-by-case” basis, but the presence of “any single aggravating factor” may justify a penalty at or close to the maximum regardless of the presence of one or more mitigating factors.
• On the aggravating side, OIG will consider actual knowledge as an aggravating factor where a “knows or should know” scienter standard is required to establish liability. OIG also changed the threshold for when the loss amount could be considered aggravating from “substantial” to $50,000 or more.
• On the mitigating side, OIG sets limits on the “corrective action” factor. The rule says that “corrective action must include” use of “and fully cooperating with” OIG’s Self-Disclosure Protocol (SDP) or the Centers for Medicare & Medicaid Services’ (CMS’s) Self-Referral Disclosure Protocol (SRDP). OIG states that if “the conduct involves only overpayments and no CMP liability, there is no penalty at issue to mitigate.” Here, OIG doubles-down on its “carrot and stick” approach to encourage use of the SDP or SRDP by indicating it may take a more aggressive stance when seeking penalties in an affirmative case. In the preamble, OIG confirmed that it will continue to generally apply the 1.5 multiplier on SDP submissions, even if aggravating factors are present.
• As the last factor shows, OIG retains expansive regulatory discretion in the monetary and exclusion approach it chooses to take in an individual case.

Alternate Methodology for Employing Excluded Persons

OIG codified the SDP’s alternate “damages” methodology for calculating the assessment for employing or contracting with excluded persons to provide items or services that are billed to federal health care programs as part of a bundled payment. Where the item or service provided by the excluded person is separately billable (e.g., physicians billing for office visits and pharmacist filling prescriptions), the employing or contracting party will continue to be subject to assessments and penalties based on the number and value of those separately billable items and services. However, where the item or service provided by the excluded person is non-separately billable, assessments are based on the total costs to the employer or contractor of the excluded person (including salary, benefits, etc.). “Non-separately billable” items or services include nursing or clerical services associated with a physician office visits, skilled nursing facility per-diem payments or hospital prospective payments. In response to commenters’ objections, OIG moved away from the proposed rule’s per-day penalty to a penalty based on the number of items or services provided by the excluded person.

Notably, OIG rejected commenters’ suggestions to consider the entity’s federal health care program payor mix when calculating the assessment. OIG gave a few reasons for this position, such as some difficulty in determining the payor mix for certain provider types and a desire to reserve this benefit for resolving SDP submissions and negotiating settlements in affirmative cases. Again, OIG is using the CMP regulations to incentivize self-disclosure, but also indicated that entities could seek to negotiate a payor mix discount in an affirmative case provided the entity can show a reasonable calculation method.

New ACA Authorities

OIG codified the changes to its CMP authorities from the Affordable Care Act (ACA) into regulations. Under the ACA, OIG may impose CMPs for the following reasons:

• Failing to grant the OIG timely access to records in response to a reasonable request
• Ordering and prescribing while excluded
• Making false statements, omissions or misrepresentations in an application to participate or enroll as a provider in a federal health care program
• Failing to report and return an overpayment
• Making or using a false record or statement that is material to a false or fraudulent reimbursement claim

OIG also obtained new CMP authorities against Part C and D managed care plans for enrolling individuals without their consent, transferring an enrollee to another plan without their consent or solely for the purpose of earning a commission, or failing to adhere to CMS’ applicable marketing restrictions. The managed care section of the regulations specifies which CMP authorities apply to different types of managed care organizations, reflecting the disparate statutory structure. In addition, under the ACA and these final regulations, OIG may hold managed care companies responsible not just for the actions of its employees, but also for those entities with which it contracts.

EMTALA Becomes More Aggressive

The new regulations also ramp up penalties under the Emergency Medical Treatment and Labor Act (EMTALA). Based on the inflation adjustments made in September, most hospitals and “responsible physicians” are now subject to a maximum CMP of $103,139 for violating EMTALA, and penalties be assessed against on-call physicians who fail or refuse to appear within a reasonable time. The new regulations removed several mitigating factors that were favorable to hospitals, such as an individual subsequently demonstrated a clear intent to the leave or the hospital developed and implemented a corrective action plan. OIG noted that hospitals always have to develop and implement a corrective action plan as part of successfully resolving a CMS survey of an EMTALA complaint. Instead, OIG narrowed the mitigating factor to when the hospital self-reports to CMS before CMS receives a complaint from another source or otherwise learns of the incident and completes its corrective action prior to CMS initiating an investigation.

CMP for Drug-Price Reporting

Drug manufacturers have been subject to CMPs as part of the Medicaid Drug Rebate statute for not reporting, or late reporting, correct drug pricing and product information to CMS. This pricing information includes the average manufacturer price (AMP), average sales price (ASP), wholesale acquisition costs and best price. How precisely OIG would calculate the penalty amount has not been clear to date because there were no regulations for this CMP, until now. OIG finalized its proposed approach to calculate penalties at the National Drug Identifier (NDC) level for both the daily penalty for late reporting and the penalty for reporting false information or refusing to provide information requested by HHS. For example, OIG could seek up to $89,080 per day for each day a manufacturer is late reporting pricing data for five NCDs (based on the inflation-adjusted maximum penalty of $17,816).